39 items
XSS from LLM HTML Output
Code QuizAllow-List Before Downstream Action
Code QuizBlocking Sensitive Data Exfiltration
Code QuizGuarding Against Jailbreak Overrides
Code QuizSandboxing Model-Generated Code
Code QuizSanitizing URLs to Prevent SSRF
Code QuizOpting Out of Provider Training
Code QuizTrusting Model Output for Authorization
Code QuizMasking PII in Model Output
Code QuizExcessive Agency and Confused Deputy
Slides / VideoOWASP Top 10 for LLM Apps
Slides / VideoGDPR & HIPAA for LLM Data
Slides / VideoVendor Data Retention & Opt-Out
Slides / VideoInjection Risks in RAG Documents
Slides / VideoRedact PII Before Embedding
Code QuizLeast-Privilege Design for Tool Access
Slides / VideoTrusted Instructions vs Untrusted Data
Slides / VideoOver-Privileged Tool Access
Code QuizUngated Tool Execution
Code QuizLogging API Keys in Prompts
Code QuizLogging Raw Sensitive User Data
Code QuizIndirect Injection via Retrieved Content
Code QuizWrong Role for User Data
Code QuizTreating Documents as Instructions
Code QuizEncryption In Transit and At Rest
QuizTrusted vs Untrusted Input Separation
QuizExcessive Agency in Agents
QuizDelimiting Untrusted Content
QuizData Exfiltration via Outputs
QuizDirect vs Indirect Prompt Injection
QuizPreventing Secret Leakage in Prompts
QuizSystem Prompt Leakage
QuizMulti-Tenant Data Isolation
QuizProvider Data Retention Policies
QuizRAG Injection via Retrieved Docs
QuizLeast-Privilege for LLM Resources
QuizData Exfiltration via LLM Outputs
Slides / VideoSystem Prompt Leakage and Extraction
Slides / VideoDirect vs Indirect Prompt Injection
Slides / VideoBlocking Sensitive Data Exfiltration
A guard detects a secret in output but still returns the leaked text.
function returnSafeOutput(modelOutput) {
const secretPattern = /sk-[A-Za-z0-9]{20,}/;
if (secretPattern.test(modelOutput)) {
console.warn('Possible secret leak detected!');
}
return modelOutput;
}What is the bug that lets sensitive data still reach the user?